feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/service/group_service.go

@@ -70,6 +70,8 @@ type GroupService interface {
 	LeaveGroup(userID string, groupID string) error
 	RemoveMember(userID string, groupID string, targetUserID string) error
 	GetMembers(groupID string, page, pageSize int) ([]model.GroupMember, int64, error)
+	// GetMembersForUser 用户侧获取成员列表，校验 requesterID 是否为群成员。
+	GetMembersForUser(requesterID, groupID string, page, pageSize int) ([]model.GroupMember, int64, error)
 	SetMemberRole(userID string, groupID string, targetUserID string, role string) error
 	SetMemberNickname(userID string, groupID string, nickname string) error
 	MuteMember(userID string, groupID string, targetUserID string, muted bool) error
@@ -91,6 +93,9 @@ type GroupService interface {
 	// 获取成员信息
 	GetMember(groupID string, userID string) (*model.GroupMember, error)
 
+	// IsGroupMember 检查用户是否为群成员（用户侧可见性校验）。
+	IsGroupMember(userID string, groupID string) bool
+
 	// 游标分页方法
 	GetGroupsByCursor(ctx context.Context, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Group], error)
 	GetUserGroupsByCursor(ctx context.Context, userID string, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Group], error)
@@ -1192,6 +1197,9 @@ func (s *groupService) RemoveMember(userID string, groupID string, targetUserID
 }
 
 // GetMembers 获取群成员列表（带缓存）
+//
+// 注意：本方法不校验调用者是否为群成员，仅供内部/admin 路径调用。
+// 用户侧路由应使用 GetMembersForUser，后者会校验 requesterID 是否为群成员。
 func (s *groupService) GetMembers(groupID string, page, pageSize int) ([]model.GroupMember, int64, error) {
 	cacheSettings := cache.GetSettings()
 	groupMembersTTL := cacheSettings.GroupMembersTTL
@@ -1235,6 +1243,24 @@ func (s *groupService) GetMembers(groupID string, page, pageSize int) ([]model.G
 	return result.Members, result.Total, nil
 }
 
+// GetMembersForUser 用户侧获取群成员列表：校验调用者是否为群成员。
+//
+// 安全语义：成员列表仅群成员可见。非成员访问返回 ErrNotGroupMember，
+// 避免群成员信息被任意登录用户枚举。
+func (s *groupService) GetMembersForUser(requesterID, groupID string, page, pageSize int) ([]model.GroupMember, int64, error) {
+	if requesterID == "" {
+		return nil, 0, ErrNotGroupMember
+	}
+	isMember, err := s.groupRepo.IsMember(groupID, requesterID)
+	if err != nil {
+		return nil, 0, err
+	}
+	if !isMember {
+		return nil, 0, ErrNotGroupMember
+	}
+	return s.GetMembers(groupID, page, pageSize)
+}
+
 // SetMemberRole 设置成员角色
 func (s *groupService) SetMemberRole(userID string, groupID string, targetUserID string, role string) error {
 	// 检查群组是否存在
@@ -1596,6 +1622,18 @@ func (s *groupService) GetMember(groupID string, userID string) (*model.GroupMem
 	return s.groupRepo.GetMember(groupID, userID)
 }
 
+// IsGroupMember 检查用户是否为群成员。
+func (s *groupService) IsGroupMember(userID string, groupID string) bool {
+	if userID == "" || groupID == "" {
+		return false
+	}
+	ok, err := s.groupRepo.IsMember(groupID, userID)
+	if err != nil {
+		return false
+	}
+	return ok
+}
+
 // ==================== 游标分页方法 ====================
 
 // GetGroupsByCursor 游标分页获取群组列表